adr-sml/infra/cloudfront/router.test.mjs

/**
 * Unit test for the viewer-request router. `node infra/cloudfront/router.test.mjs`.
 *
 * The function file cannot use module syntax — CloudFront's runtime has no
 * `export` — so it is read and evaluated rather than imported. `aws cloudfront
 * test-function` is the authoritative check because it runs the real runtime;
 * this one runs in a second, catches the branch mistakes, and costs nothing.
 */
import { readFileSync } from 'node:fs';
import { fileURLToPath } from 'node:url';
import { dirname, join } from 'node:path';

const here = dirname(fileURLToPath(import.meta.url));
const src = readFileSync(join(here, 'router.js'), 'utf8');
const handler = new Function(`${src}; return handler;`)();

const req = (uri, querystring = {}) => ({ request: { uri, querystring } });

const CASES = [
  // [uri, querystring, expected]  — expected is {uri} for a rewrite/passthrough
  //                                 or {status, location} for a redirect.
  ['/', {}, { uri: '/index.html' }],
  ['/about/', {}, { uri: '/about/index.html' }],
  ['/practice/construction/', {}, { uri: '/practice/construction/index.html' }],
  ['/contact/received/', {}, { uri: '/contact/received/index.html' }],
  ['/about', {}, { status: 301, location: '/about/' }],
  ['/practice/energy', {}, { status: 301, location: '/practice/energy/' }],
  // Files are untouched — every one of these is a real object in dist/.
  ['/robots.txt', {}, { uri: '/robots.txt' }],
  ['/sitemap-index.xml', {}, { uri: '/sitemap-index.xml' }],
  ['/404.html', {}, { uri: '/404.html' }],
  ['/favicon.ico', {}, { uri: '/favicon.ico' }],
  ['/pouya-lajevardi-bio.pdf', {}, { uri: '/pouya-lajevardi-bio.pdf' }],
  ['/_astro/schema.Cm5su60K.css', {}, { uri: '/_astro/schema.Cm5su60K.css' }],
  ['/og/mediation.jpg', {}, { uri: '/og/mediation.jpg' }],
  // The query string survives the redirect, normalised to `name=value`.
  [
    '/fees',
    { utm_source: { value: 'linkedin' }, ref: { value: '' } },
    { status: 301, location: '/fees/?utm_source=linkedin&ref=' },
  ],
  /* ⚠️ THE OPEN-REDIRECT CASES. CloudFront forwards duplicate leading slashes
     verbatim (it collapses dot-segments but not `//`), so without normalisation
     `//evil.example.com/x` produced `Location: //evil.example.com/x/` — a
     network-path reference that sends the viewer to another host from this
     domain's own URL. The backslash form defeats a `startsWith('//')` guard,
     because the URL Standard maps `\` to `/` in special schemes. Both must stay
     same-origin, and both must keep a SINGLE leading slash. */
  [
    '//evil.example.com/x',
    {},
    { status: 301, location: '/evil.example.com/x/' },
  ],
  [
    '///evil.example.com/x',
    {},
    { status: 301, location: '/evil.example.com/x/' },
  ],
  [
    '/\\evil.example.com/x',
    {},
    { status: 301, location: '/evil.example.com/x/' },
  ],
  /* ⚠️ A NORMALISED PATH IS REDIRECTED, NOT REWRITTEN — this asserted a 200 for
     one revision, which closed the redirect and opened an unbounded family of
     duplicate URLs for every page on the site. */
  [
    '//evil.example.com/x/',
    {},
    { status: 301, location: '/evil.example.com/x/' },
  ],
  ['//about/', {}, { status: 301, location: '/about/' }],
  ['///about/', {}, { status: 301, location: '/about/' }],
  ['/\\about/', {}, { status: 301, location: '/about/' }],
  /* A file is normalised too. This branch returned `request` untouched for one
     revision, so `//robots.txt` reached S3 with the doubled slash and 404'd. */
  ['//robots.txt', {}, { status: 301, location: '/robots.txt' }],
  ['/\\robots.txt', {}, { status: 301, location: '/robots.txt' }],
  /* An interior `//` is left alone on purpose: it is a key that does not exist,
     so it resolves to the 404 page. Only the leading run is a security question. */
  ['/a//b/', {}, { uri: '/a//b/index.html' }],
  /* Header-injection surface: CR, LF, space and the delimiters browsers disagree
     about are stripped rather than re-encoded — an already-encoded value must not
     be encoded twice. `%20` therefore passes through untouched. */
  [
    '/fees',
    { q: { value: 'a b"><x' }, utm: { value: 'a%20b' } },
    { status: 301, location: '/fees/?q=abx&utm=a%20b' },
  ],
  [
    '/fees',
    { evil: { value: 'x\r\nSet-Cookie: a=b' } },
    { status: 301, location: '/fees/?evil=xSet-Cookie:a=b' },
  ],
  /* `#` changes the STRUCTURE of the Location — without stripping it, `&b=y`
     lands in a fragment and the parameter is silently lost. */
  [
    '/fees',
    { a: { value: 'x#&b=y' } },
    { status: 301, location: '/fees/?a=x&b=y' },
  ],
  /* ⚠️ AND THESE MUST SURVIVE. `| ^ ` { }` are not in WHATWG's query
     percent-encode set, so a browser sends them raw — and `|` is routine in
     ad-platform tracking values. One revision of `safe()` stripped all of them,
     silently corrupting exactly the campaign links the 301 exists to preserve. */
  [
    '/fees',
    { utm_content: { value: 'banner|top' }, k: { value: 'a{b}c^d`e' } },
    { status: 301, location: '/fees/?utm_content=banner|top&k=a{b}c^d`e' },
  ],
  // multiValue, which no case exercised before.
  [
    '/fees',
    { tag: { value: 'a', multiValue: [{ value: 'a' }, { value: 'b' }] } },
    { status: 301, location: '/fees/?tag=a&tag=b' },
  ],
  /* /api/intake must NEVER be redirected — a 301 turns a POST into a GET and
     the submission body is gone. This function is not associated with the
     /api/* behaviour, so this case documents WHY the association matters: if it
     ever were associated, this is the damage. */
  ['/api/intake', {}, { status: 301, location: '/api/intake/' }],
];

let pass = 0;
const failures = [];
for (const [uri, qs, expected] of CASES) {
  const out = handler(req(uri, qs));
  let actual;
  if (out.statusCode) {
    actual = { status: out.statusCode, location: out.headers.location.value };
  } else {
    actual = { uri: out.uri };
  }
  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
  else
    failures.push(
      `${uri} -> ${JSON.stringify(actual)}, expected ${JSON.stringify(expected)}`,
    );
}

if (pass + failures.length !== CASES.length) {
  throw new Error(`case count ${pass + failures.length} != ${CASES.length}`);
}
console.log(`router: ${pass} of ${CASES.length} cases pass`);
for (const f of failures) console.error('  FAIL ' + f);
if (failures.length > 0) process.exit(1);